net-kingdom/docs/security-layer-v0.8-publication-readiness.md

Proposed security-layer v0.8 publication readiness — 2026-10-10

Derived source-assembly record, not ratification or a technical review in another owner's voice. Exact proposed cut: canon/standards/security-layer-model_v0.8.md SHA256 103a635f19ab9fe53094d69c3eeebcccd8e87ac9588846167e7e204a7c6de167. v0.7 remains accepted; checkers and publication pointers are unchanged. Adjacent sources JSON pins every record/return/reference checker.

Concrete delta

A9 supplies the four closed tokens and ASCII-insensitive comparison. A10 supplies the evidence-source column yes/no/unassessed (only access-engine yes, audit-core no; other rows unassessed), source marking and per-event-class emission inventories. A11 r2 makes INTENT frontmatter govern, sidecars derived, disagreement a finding, and requires stated scope including the permitted single-repository scope. A12 r3 forbids standard/companion pins, excludes provenance citations and non-declaration stance/claim/evidence maps, and places version/scope in every run. The quoted normative paragraphs are taken from exact amendment-set v0.3, SHA256 9b454b83c9aeed08ba13dba4d812f5ae6b4293ced9e43088d64cc3cc00b1459d.

GH-DEC-2026-024's A2 correction extends explicit non-completeness statements to load-bearing guarantees where the guarantee is not itself completeness; it leaves the existing volume/rare heartbeat-and-reconciliation requirement intact. Its A10 correction distinguishes no from unassessed; its failure-path release exception remains refused. No fresh doctrine, observation or actuation capability is manufactured. §14 and §15 record current assembly and bounded review provenance.

A13's coordinate note is a factual publication adaptation: the circulated text said flex-auth was the currently resolving repository and the governed rename was pending. FLEX-WP-0020 records completed operation a15af186 on September30; the assembled note preserves the ruled authority and flex-auth runtime names, identifies the now-resolved access-engine repository coordinate and retains the migration-owner record as execution authority. The three fresh worker returns assent only to A11 r2/A12 r3; they do not review this factual A13 adaptation or ratify the final assembled cut. Its provenance is the migration-owner receipt, not a new layer or runtime naming ruling.

GH-DEC-2026-019 closing-condition evidence

1. Amendments drafted/circulated/dispositioned: source-complete. GateHouse GH-WP-0004-T09 is now done in the applied workplan. The three dedicated owner returns are applied under kings-guard, approval-engine and railiance-master; their exact SHA256 values match T09's recorded table and the common current amendment SHA256 above. Existing earlier returns remain correctly scoped history. No earlier-version approval is carried forward or silence counted as assent. T09's source disposition is not founder acceptance of this cut.
2. AuditCore §11 review: returned September23, not declined; T07 done. GH024/T12 disposition resolves both findings and refuses the proposed exception; the assembly now includes those source corrections. §9.5's KingsGuard review was wanted but explicitly not a GH019 acceptance condition and is not inferred.
3. Four declarations/dated gaps: T08 done, naming GateHouse, KeyCape, OpsMason and NetKingdom records. This asks declaration or dated gap, not universal conformance.

All three GH019 conditions are now source-evidenced complete in applied owner/GateHouse records, and this exact final proposed cut carries their amendments. Prepare informed-decision with the cut digest and disposition receipts. Requested human act: accept the assembled v0.8 publication cut, including the bounded A13 factual coordinate update, as the new standard under NetKingdom's publication responsibility. A human answer is not inferred from technical returns or source application. Until then status remains proposed and v0.7 governs.

GH-WP-0004-T11 checker convergence is post-flip: eight named implementers change VALIDATED_AGAINST and detector copies, or retain a dated reason. It is not a pre-flip requirement to name proposed v0.8 as normative. Companion alignment and current publication pointer changes likewise belong to the concrete approved publication action; they are not performed by this source preparation.

Verification

Unchanged ops-warden reference checker passed, explicitly naming accepted v0.7 plus GH017/GH020/GH021 and its run scope. Its existing tests passed 28/28 via PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -q -p no:cacheprovider tests/test_layer_conformance.py. This verifies the established declaration/detector reference, not an estate-wide v0.8 compliance run. Source assembly checks compare A9/A11r2/A12r3 quotations, the complete GH024/A2 non-claim paragraph byte for byte, catalogue markings and retained emission bounds; no source checker was silently repointed, and no native security execution occurred.

No new live workload, credential, grant or risk exception is involved. The proposed publication action is reversible through versioned canon/pointer restoration; owner migrations require separate reviewed commits. Existing build exceptions remain declared and are not legalized by accepting this standard.